The short answer
There is no such thing as an “EU AI Act compliance certificate.” Regulation (EU) 2024/1689 (the EU AI Act) creates no certificate, seal or scheme that certifies an organisation, a product or a person as “AI Act compliant.” No regulator, notified body or private company can issue one.
What the AI Act does create is narrower. Providers of high-risk AI systems must complete a conformity assessment, sign an EU declaration of conformity, affix a CE marking and register the system. In most cases the provider assesses itself. Only a small set of systems involves a notified body, which issues a certificate covering that one system’s quality management system and technical documentation, not the company’s overall compliance.
If someone sells you an “EU AI Act certificate,” you are buying a training credential, an audit opinion or a marketing badge. It may be useful. It is not legal proof of compliance.
Key takeaways
- There is no EU AI Act compliance certificate for companies, products or people.
- High-risk AI systems need conformity assessment. For Annex III points 2–8 it is self-assessment under Annex VI.
- Notified body certificates exist only under Annex VII, mainly for some biometric systems, and cover one system for up to four or five years.
- The provider, not a certifier, signs the EU declaration of conformity and carries the responsibility.
- ISO/IEC 42001, training certificates, codes of practice and vendor seals are evidence at best, never proof.
Why everyone is asking for a certificate that doesn’t exist
Buyers want one document that settles the question. Procurement teams add “Are you EU AI Act certified?” to vendor questionnaires. Boards ask legal teams for a badge. A market of courses, audits and seals has grown up to answer them.
The instinct is understandable. ISO 27001 trained a generation of buyers to expect a third-party certificate for every regulatory risk. GDPR never worked that way, and the AI Act doesn’t either.
Getting this wrong has a real cost. A company that relies on a vendor’s “AI Act certificate” may skip the due diligence the law actually expects of deployers. A provider that buys one may believe it has met obligations it hasn’t started.
Key definitions, in the Act’s own words
The word “certification” appears in the AI Act only in a narrow, technical sense. These are the terms that matter, quoted from Article 3 of Regulation (EU) 2024/1689.
Conformity assessment — Article 3(20): “‘conformity assessment’ means the process of demonstrating whether the requirements set out in Chapter III, Section 2 relating to a high-risk AI system have been fulfilled”
Note the scope: a process, for a high-risk AI system, against a specific set of requirements. Not a status for a company.
Conformity assessment body — Article 3(21): “‘conformity assessment body’ means a body that performs third-party conformity assessment activities, including testing, certification and inspection”
Notified body — Article 3(22): “‘notified body’ means a conformity assessment body notified in accordance with this Regulation and other relevant Union harmonisation legislation”
A training provider, consultancy or SaaS platform is not a notified body unless a Member State has notified it to the Commission for this purpose.
CE marking — Article 3(24): “‘CE marking’ means a marking by which a provider indicates that an AI system is in conformity with the requirements set out in Chapter III, Section 2 and other applicable Union harmonisation legislation providing for its affixing”. The CE mark is affixed by the provider. It is a self-declaration, not a certificate issued by someone else.
EU declaration of conformity — Article 47(2) and (4): “The EU declaration of conformity shall state that the high-risk AI system concerned meets the requirements set out in Section 2.”
“By drawing up the EU declaration of conformity, the provider shall assume responsibility for compliance with the requirements set out in Section 2.”
Responsibility stays with the provider. No third party can take it off your hands with a certificate.
Harmonised standard — Article 3(27) points to Regulation (EU) No 1025/2012. Under Article 40(1), following a harmonised standard published in the Official Journal gives a presumption of conformity, “to the extent that those standards cover those requirements or obligations.” A presumption is rebuttable. It is not a certificate.
AI Act compliance certificate: What the AI Act requires instead
For a high-risk AI system, the provider runs a conformity assessment, signs a declaration, affixes the CE mark and registers the system. Which conformity assessment route applies depends on the system, under Article 43.
| High-risk system type | Conformity assessment route | Notified body involved? | What the provider ends up with |
| Annex III points 2–8 (employment, education, credit, essential services, law enforcement, migration, justice, critical infrastructure) | Internal control, Annex VI | No | Own technical documentation, EU declaration of conformity, CE mark |
| Annex III point 1 (biometrics), harmonised standards or common specifications applied | Provider’s choice: Annex VI or Annex VII | Optional | Either of the above, or a notified body certificate under Article 44 |
| Annex III point 1 (biometrics), standards not applied or not available | Annex VII | Yes | Notified body certificate under Article 44, plus declaration and CE mark |
| AI in products under Annex I Section A (e.g. medical devices, toys, lifts) | The sectoral law’s own procedure | Where the sectoral law requires it | One sectoral certificate that also covers the AI Act requirements |
Article 43(2) is explicit about the largest category:
“For high-risk AI systems referred to in points 2 to 8 of Annex III, providers shall follow the conformity assessment procedure based on internal control as referred to in Annex VI, which does not provide for the involvement of a notified body.”
In other words, most high-risk systems need no third party at all. A recruitment-screening tool is self-assessed by its provider.
The one place “certificates” appear: Article 44
Article 44(1) reads:
“Certificates issued by notified bodies in accordance with Annex VII shall be drawn-up in a language which can be easily understood by the relevant authorities in the Member State in which the notified body is established.”
These certificates are real, but tightly scoped. They are issued only by notified bodies, only under Annex VII, and only for a specific AI system. Under Article 44(2) they last at most four years for Annex III systems and five for Annex I systems. Under Article 44(3) the notified body can suspend or withdraw them. They say nothing about the company’s other systems, its deployer obligations, its transparency duties or its GPAI obligations.
The four steps that replace “AI Act compliance certificate”
- Conformity assessment (Article 43) — internal control or notified body, as above.
- EU declaration of conformity (Article 47) — signed by the provider, kept for 10 years.
- CE marking (Article 48) — affixed by the provider.
- Registration (Article 49) — in the EU database before placing on the market.
After that, obligations continue: post-market monitoring, serious incident reporting, and a fresh conformity assessment after any substantial modification.
Five things often sold as “AI Act compliance certificate”
Each of these can be useful. None of them is legal proof of AI Act compliance.
| What it is | What it actually proves | Why it isn’t an AI Act compliance certificate |
| ISO/IEC 42001 certificate | An accredited body audited your AI management system against an international standard | It is a voluntary management-system standard, not the AI Act. It certifies the organisation’s processes, not a specific system’s conformity with Chapter III, Section 2 |
| “Certified AI Act professional” courses | A person completed training and maybe passed an exam | Article 4 requires organisations to take AI literacy measures. It requires no certificate and no accredited course |
| Signing the GPAI Code of Practice | A general-purpose AI model provider committed to a set of practices | Under Article 53(4) a code of practice is a way to demonstrate compliance until harmonised standards exist. It is not a certificate and can be challenged |
| EU cybersecurity certificate (Regulation (EU) 2019/881) | A product met a published cybersecurity scheme | Under Article 42(2) it creates a presumption only for the cybersecurity requirements in Article 15, and only to the extent the scheme covers them |
| Vendor badges and “AI Act ready” seals | The vendor paid for, or awarded itself, a marketing label | No legal effect. If it implies an official status, it may itself mislead buyers |
What Article 4 actually says about AI literacy
The training market leans hardest on Article 4. Since Regulation (EU) 2026/1744 replaced it with effect from 27 July 2026, it reads that providers and deployers:
“shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”
and adds:
“This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.”
A training certificate can be good evidence that you took measures. It is not a qualification the law asks for.
How to read an AI Act certificate’s vendor’s claim
Ask three questions. Who issued it, and are they a notified body for the AI Act? Which AI system does it cover? Which article of the AI Act does it relate to?
If the answers are “a private company,” “all of them” and “none,” it is a marketing artefact.
Examples: what “compliance proof” looks like for five real cases
1. A CV-screening tool sold to employers. Employment is Annex III point 4, so the system is high-risk. The provider follows internal control under Annex VI, draws up technical documentation, signs the EU declaration of conformity, affixes the CE mark and registers the system. No notified body, no certificate. The employer, as deployer, has its own Article 26 duties, such as human oversight and informing workers.
2. A remote biometric identification system. This is Annex III point 1. If the provider has applied harmonised standards, it may choose internal control or a notified body. If it hasn’t, a notified body must assess it under Annex VII and issues an Article 44 certificate. This is the closest thing to “AI Act certification” that exists, and it covers that one system only.
3. An AI diagnostic feature in a medical device. The device already goes through a notified body under the Medical Devices Regulation. Under Article 43(3) the AI Act requirements are checked inside that same procedure. The output is a sectoral certificate, not a separate AI Act one.
4. A customer-service chatbot. Not high-risk. No conformity assessment, no CE mark, no certificate. The provider must still meet Article 50 transparency duties, so people know they are talking to an AI system.
5. A general-purpose AI model. Chapter V obligations apply to the model provider: technical documentation, a copyright policy and a training-data summary, with more for systemic-risk models. Compliance can be shown through the Code of Practice or other adequate means. There is no conformity assessment and no certificate for GPAI models.
When conformity assessment actually bites
The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the high-risk dates. Stand-alone Annex III systems now face conformity assessment from 2 December 2027, and AI in Annex I products from 2 August 2028 (Orrick; Cooley).
| Date | What applies |
| 2 Aug 2030 | High-risk systems intended for use by public authorities |
| 2 Aug 2028 | High-risk AI in products under Annex I harmonisation legislation |
| 2 Dec 2027 | Stand-alone Annex III high-risk systems: conformity assessment, declaration, CE mark, registration |
| 2 Dec 2026 | New Article 5 prohibitions (non-consensual intimate imagery, CSAM); Article 50(2) marking for generative systems placed on the market before 2 Aug 2026 |
| 2 Aug 2026 | Article 50 transparency obligations |
| 27 Jul 2026 | Digital Omnibus in force; Article 4 AI literacy text replaced |
| 2 Aug 2025 | GPAI model obligations; rules on notifying authorities and notified bodies |
| 2 Feb 2025 | Prohibited practices; AI literacy |
The delay changes when, not what. Even in 2028 there will be no general compliance certificate, only system-level conformity assessments.
FAQ
Is there an official EU AI Act certification?
No. The AI Act creates no certificate of compliance for organisations, products or people. It requires conformity assessment for high-risk AI systems, and only some of those involve a notified body certificate under Article 44.
Can my company become “EU AI Act certified”?
No. Obligations attach to roles (provider, deployer, importer, distributor) and to specific AI systems. There is no company-level status to certify.
Who can issue an AI Act compliance certificate?
Only a notified body, designated by a Member State and notified to the Commission, and only under the Annex VII procedure for a specific high-risk system. Consultancies, training firms and software vendors cannot.
Does ISO/IEC 42001 certification mean I comply with the AI Act?
No. ISO/IEC 42001 is a voluntary AI management-system standard. It can support a quality management system under Article 17, but it does not prove that any AI system meets Chapter III, Section 2.
Do my employees need an AI Act certificate for AI literacy?
No. Amended Article 4 requires providers and deployers to take measures to support AI literacy. It expressly does not require any guaranteed level of literacy, and no certificate is prescribed.
Is the CE mark a compliance certificate?
No. The provider affixes the CE mark itself after completing conformity assessment and signing the EU declaration of conformity. It signals the provider’s claim of conformity and its responsibility for it.
My AI system isn’t high-risk. What AI Act certificate do I need?
You don’t need a conformity assessment. You may still have Article 50 transparency duties, Article 4 AI literacy duties and, if you build a GPAI model, Chapter V obligations. Check that none of your uses falls under Article 5 prohibitions.
What should I ask for in a vendor questionnaire instead?
Ask for the vendor’s role under the Act, the risk classification of each system and the reasoning, and, for high-risk systems, the EU declaration of conformity, the EU database registration and the instructions for use. For Annex VII systems, ask for the notified body certificate and its validity date.
Did the Digital Omnibus remove these obligations?
No. Regulation (EU) 2026/1744 postponed the high-risk dates to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). The conformity assessment architecture is unchanged.